SB2020090228 - Ubuntu update for xorg-server

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Integer underflow (CVE-ID: CVE-2020-14346)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer underflow in the XIChangeHierarchy(). A local user can send a specially crafted request to the affected application, trigger integer underflow and execute arbitrary code on the target system with elevated privileges.

2) Improper Initialization (CVE-ID: CVE-2020-14347)

The vulnerability allows a local authenticated user to gain access to sensitive information.

A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.

3) Integer underflow (CVE-ID: CVE-2020-14361)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer underflow in the XkbSelectEvents(). A local user can send a specially crafted request to the affected application, trigger integer underflow and execute arbitrary code on the target system with elevated privileges.

4) Integer underflow (CVE-ID: CVE-2020-14362)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer underflow in the XRecordRegisterClients(). A local user can send a specially crafted request to the affected application, trigger integer underflow and execute arbitrary code on the target system with elevated privileges.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4488-1